Signs of a Data Breach

 1) Unusual Network Traffic:

As part of regular monitoring and vigilance, look out for

a) Unexpected outbound connections (IP address and port) from internal systems. This could be primary indication of C2C, RAT or remote control by malicious actors.
b) Unexplained traffic spikes or bandwidth consumption which could be early indicators for DDoS or cryptojacking attacks.
c) Unfamiliar IP addresses or domains in network logs. Often it could be part of reconnaissance. Keep close watch on the activity.

 

2) Anomalous System Behavior: 

Key indicators to look out for

a) Performance degradation, system crashes, or frequent errors. Usually this may be reported by end users or application system owners. Do not ignore.
b) Unauthorized changes to configurations or files.Unless a robust change mgmt and configuration mgmt process is in place, this may be difficult to detect.
c) Unusual processes or services running on systems. A strong indication of unauthorized malicious access to the system. 

 

3) Abnormal activities in the logs

Most organizations do not make significant efforts to enable critical logging and conduct timely review/analysis for potential breaches.

a) Increased failed login attempts, especially on critical systems may be indicator for unauthorized access attempts.
b) Unusual logins from unfamiliar locations or outside normal business hours. Check for these activities or logs from UBA tools.
c) Log entries indicating privilege escalation or unauthorized access attempts. Monitoring usage of PID is critical tasks and use of these privileged accounts must be reviewed. 

4) Unexpected Data transfers

Data exfiltration attempts must be monitored in real time.

a) Unexplained large data transfers - Check source /destination and identify if its a legitimate activity.
b) Unusual file modifications or deletions is again a sign of malicious activity. File integrity controls help track the changes. 

5) Alerts from SOC / monitoring tools 

What to look for?

a) Don't ignore notifications from intrusion IDS/IPS systems as it can detect fraudulent activity early.
b) Anti-malware /EDR detecting suspicious or malicious files. This could be potential sign of malware attack.
c) Firewall / VPN notifications indicating unauthorized access attempts. 

6) Social engineering

Don't ignore social engineering incident reports. It might turn out to be false alerts, but early detection can save you from major data breach. 

a) Increased reports of phishing emails, social engineering attempts such as fake LinkedIn requests.
b) Employees falling victim to social engineering attacks.
c) Incidents such as data leakage resulting from access to unauthorized print outs or poor data disposal hygeine.

7) Open vulnerabilities in applications & infrastructure

Systems that aren't patched or have reached its end of life - are prime targets for criminals.

a) Unpatched or outdated software with known vulnerabilities. Check if known vulnerabilities like log4j are remediated.
b) Exploited vulnerabilities from penetration test reports, if not remediated, could lead to data breaches.

8) External Threat intelligence & staff incident reports

Don't ignore incident reported by external partners or your staff. 

a) Notifications from third-party security vendors or threat intelligence feeds.
b) Reports from employees, customers, or partners regarding suspicious activities. Some of these may be false alerts, but could be potential indicator for data breach.

9) Web 3.0 / Blockchain based systems.

Web3 / blockchain based systems have unique characteristics 

a) Unauthorized Transactions and smart contract behaviour:

• Sudden or unexpected movement of funds or assets within the blockchain network.

• Unexpected changes to the code or logic of smart contracts without proper notification or approval. 

b) Smart contract functions executing differently than expected or
producing unexpected results.

c) Multiple failed login attempts or unauthorized access attempts to wallets.

d) Evidence of attempted or successful attacks targeting the blockchain or
Web3 system, such as DDoS attacks, 51% attacks, or known vulnerabilities
being exploited.

Active Directory Security Checklist

1 Limit the use of Domain Admins and other Privileged Groups

Members of Domain Admins and other privileged groups are very powerful. They can have access to the entire domain, all systems, all data, computers, laptops, and so on.

It is recommended to have no day to day user accounts in the Domain Admins group, the only exception is the default Domain Administrator account.

 

2 Use at least two Accounts

You should use a regular account with no administrator rights for day-to- day tasks like checking email, browsing the internet and so on. Use a secondary account when you need to perform admin tasks. Use the least privilege model, give permissions to only what is needed.

 

3 Secure the Domain Administrator Account

The built-in administrator account should only be used for domain setup and recovery. Set a 20+ character password on it and lock the password in a vault. No one should know the password or be using this account

 

4 Disable Local Administrator Account

Disable the local administrator account on all computers and use your individual domain account instead. The local admin is a well-known account that attackers will try to compromise and often has the same password on every computer.

 

5 Use LAPS (Local Administrator Password Solution)

If you are unable to disable the local administrator account, then use Microsoft LAPS. This will set a random unique password on all computers. The password is stored in Active Directory.

 

6 Use a Secure Workstation for administrator tasks

Use a dedicated secure workstation for performing administrative tasks. The secure admin workstation should not have internet access or be used for checking email. Login into this workstation with your admin account not your regular account.

 

7 Enable Audit Policy Settings

Use group policy to set an audit policy on all computers. Malicious activity often starts on end user devices, so it is important that auditing is enabled on all computers.

 

8 Monitor AD Events for Compromise

Monitor changes to privileged groups, spike in bad password attempts, account lockouts, use of administrator accounts and other abnormal behavior.

 

9 Use Long Passwords

If your company policy allows it, set the minimum password length to 15 characters. This is often driven by various compliance requirements.

 

10 Use Descriptive Security Groups

Avoid naming security groups with random or meaningless names. It is not easy tracking down where or how groups are used and better naming conventions can help. Example, N-Drive-HR-RW

 

11 Cleanup inactive user and computer accounts

Have a process in place to find and disable stale/unused active directory computer and user accounts.

 

12 Remove Users from the Local Administrator Group

Regular users should not have local administrator rights on computers. This makes it easy for attackers to install malicious files and compromise a network. Use PowerShell or a 3rd party tool to inventory who has local administrator rights.

 

13 Do not install additional software on domain controllers

Domain controllers should have very limited software and roles installed on them. More software you install the bigger the security risk. These are the most important servers in your domain so keep them secure by limiting what is running on them.

 

14 Patch & Vulnerability Scanning

Attackers are quick to exploit known vulnerability’s, you need to continuously scan and patch systems. Make sure you are patching 3rd party programs and upgrading or removing software that is no longer supported.

 

15 Use Secure DNS Services to block malicious traffic

You can easily block malicious traffic by using a secure DNS service such as QUAD9 or OpenDNS.

 

16 Run Supported Operating System

Keep systems on the latest operating system will help to increase overall security. Each new version of Windows includes new built-in security features and enhancements.

 

17 Use Two Factor Authentication

It is easy for attackers to compromise accounts, which can allow remote unauthorized access. Two factor authentication should be used for all remote access.

 

18 Monitor DHCP Logs

You need to know what is connecting to your network. A simple way to check this is by looking at the DHCP logs, look for hostnames that you do not recognize. If you have a naming convention it should be easy to identify unauthorized devices.

 

19 Monitor DNS Logs

DNS logs can be used to identify malicious DNS lookups. You will need to enable the windows DNS debug logs; steps are provided in full post. DNS logging is also provided on next gen firewalls. DNS lookups for random domain names are a good sign of malicious traffic on your network. Example, efdvessdtgsdg.3dfxo.com

 

20 Use ADFS & Azure Security

Take advantage of the latest ADFS & Azure security features. Microsoft continues to develop and provide security enhancements to both services.

 

21 Use Office 365 Secure Score

Secure score analyzes your office 365 tenant and provides a score based on your settings. It provides a list of issues and recommended actions to fix. May require a subscription.

 

22 Have a recovery plan

Have a response plan on how to handle a cyber-attack. 

 

23 Document Delegation to Active Directory

Delegation and AD permissions can easily get out of control. Document these permissions or use PowerShell to create a report and review regularly.

 

24 Lock Down Service Accounts

Service accounts are used to run executables, tasks, services, authentication and so on. These accounts are often set with passwords that never expire and are granted more permissions than needed. See full post for a list of tips for locking down service accounts. A better option is to use Managed service accounts

 

25 Use Secure Baselines

Default installs are not secure, use secure benchmarks and baselines to secure default settings. These settings can be deployed with group policy. Microsoft Security Compliance Toolkit and CIS SecureSuite provide baseline templates and tools.

 

26 Enable Windows Firewall

Use group policy to deploy and control the windows firewall on all computers in your organization. The firewall can control incoming/outgoing traffic to your systems.

 

27 Use application whitelisting

With application whitelisting you can block unwanted programs from running. There are third party programs that offer these features, Windows Enterprise also has this feature.

 

28 Block PowerShell for regular users

Viruses will often use PowerShell to execute commands on computers. Most of the time regular users do not need to execute PowerShell. You can control who has permissions to run PowerShell with Group Policy.